Google Chrome EUVD-2026-63595

Exploitation requires the victim to run Google Chrome at any version below 151.0.7922.173 and to be socially engineered into opening a specially crafted file via Chrome's Import feature - the user must take active steps to trigger the import action (CVSS UI:R confirmed). The CVSS vector (PR:N) confirms no attacker-side authentication or privileges are required; however, the mandatory user interaction step (opening the malicious file) limits exploitation to targeted or spear-phishing scenarios rather than fully automated drive-by attacks. SSVC's automatable: no rating corroborates this. The vulnerability is not restricted to a specific OS or deployment configuration per the CPE string; any desktop Chrome installation below the fixed version is in scope. Exploitation is blocked by: timely patching to 151.0.7922.173, user refusal to open the crafted file, and enterprise policies disabling the Import feature.

The CVSS 8.8 High score reflects a network-accessible, zero-authentication, low-complexity attack requiring only user interaction (AV:N/AC:L/PR:N/UI:R), with full impact across all three CIA pillars. A notable inconsistency exists: the CVSS scope is recorded as Unchanged (S:U), yet the description explicitly states code execution 'outside the sandbox' - behavior that typically corresponds to a Changed scope (S:C) affecting the host OS as a separate security context; this should be verified against the vendor advisory. EPSS at 0.32% (25th percentile) is low, and SSVC independently rates exploitation as none and automatable as no, together confirming that mass or opportunistic exploitation is not currently occurring. The social engineering prerequisite - requiring a user to open a crafted file through the Import feature - is the primary friction point reducing real-world risk below what the raw CVSS score implies. Despite these mitigations, SSVC's 'total' technical impact rating reflects that successful exploitation yields complete OS-level compromise, making this a genuine priority for organizations with large Chrome deployments even in the absence of active exploitation.

An attacker crafts a malicious file specifically designed to trigger the privilege elevation in Chrome's Import feature and delivers it to a target via phishing email or social media, convincing the user to import it through Chrome. When the user opens the file using the Import function, the component executes with excessive privileges, allowing the attacker's payload to escape the Chrome sandbox boundary. The attacker then gains arbitrary code execution on the host OS with the privileges of the browser process, potentially enabling credential theft, persistence installation, or lateral movement. No public exploit code has been identified at time of analysis.